If you're running SMS for a DTC brand in 2026 and your opt-in flow hasn't been touched since 2023, you're operating on borrowed time. The regulatory environment shifted materially in 2025, class action filings exploded, and carriers tightened filtering at the infrastructure level. This post breaks down exactly what changed, what the real financial exposure looks like, and what I'd fix first if I were auditing your account today.
What actually changed in TCPA law between 2025 and 2026?
More than most brands realize—and less than the panic headlines suggested. The two biggest stories moved in opposite directions.
First, the one-to-one consent rule: the FCC had proposed in December 2023 that every consumer's opt-in consent could only cover a single named seller—killing the "marketing partners may contact you" lead-gen loophole that fed bulk SMS lists for years. On January 24, 2025, the 11th Circuit Court of Appeals vacated it in Insurance Marketing Coalition v. FCC, finding the FCC exceeded its statutory authority. Under current TCPA rules, a single opt-in can cover multiple sellers if the disclosure clearly names them, though generic "our partners may contact you" language has always been risky and still is. My take: the legal reprieve doesn't make lazy consent language safe—it just means plaintiff attorneys now have to work harder, not that they've stopped trying.
Second, the opt-out expansion rule actually did land. Since April 2025, FCC rules require businesses to accept opt-out requests through any reasonable method, not just keyword replies. This includes email, phone calls, website forms, chatbots, or even in-person requests. Businesses must process opt-out requests within 10 business days and may send a single confirmation message promptly (with no promotional content) to clarify which types of messages the consumer wants to stop receiving.
There was also a significant circuit court ruling in early 2026: in Bradford v. Sovereign Pest Control (February 25, 2026), the Fifth Circuit ruled that the TCPA requires only "prior express consent" for automated telemarketing texts, not "prior express written consent" as the FCC's regulations require. This is still working through legal interpretation, but for now I'd treat prior express written consent as the gold standard until there's clearer guidance—the downside risk of relaxing your standard is not worth it.
What does a TCPA violation actually cost a DTC brand?
Enough to destroy a profitable SMS channel overnight. TCPA fines start at $500 per message, $1,500 for willful violations, and US carriers now block unregistered traffic entirely. Those aren't aggregate caps—they're per message. Run the math on a mid-size promotional blast.
A retailer that sends 50,000 promotional SMS messages to a list that includes 2,000 numbers without valid prior express written consent faces $1,000,000 in exposure at $500 per negligent violation. If a court finds the violation was willful—for example, if the consent documentation was inadequate—exposure rises to $3,000,000.
Individual class action settlements regularly run into the tens of millions, with the plaintiff bar increasingly aggressive about case selection and settlement positioning. Some of the most instructive recent examples: Zales Jewelers settled for $7.5 million for SMS marketing violations; Cash App reportedly settled for $12.5 million for unsolicited referral program texts sent without clear consent; and DSW / Designer Brands reportedly settled for $4.42 million for continuing to send marketing texts after consumers opted out.
TCPA class action filings more than doubled year-over-year through 2025. These aren't edge cases. They're systematic campaigns by plaintiff firms targeting brands with sloppy consent records and broken opt-out flows.
What does a legally defensible opt-in flow look like in 2026?
More specific than what most Shopify stores have shipped. SMS requires a separate, explicit opt-in with TCPA-specific disclosure language. Verbal agreements, pre-checked boxes, and implied consent don't qualify under TCPA.
A compliant opt-in disclosure must include your business name, a statement that the consumer agrees to receive marketing or promotional text messages, the expected message frequency (for example, "up to 4 messages per month"), a note that message and data rates may apply, and instructions on how to opt out (for example, "Reply STOP to unsubscribe") and get help ("Reply HELP for support").
Here's what I'd audit in your existing flows:
- Checkout opt-in: Order confirmations and shipping notifications imply consent for order-related messages, but must not include marketing. If your Klaviyo post-purchase flow fires a promotional text to someone who only checked "shipping updates," that's a violation.
- Pop-up forms: Opt-in records must be retained with timestamp, IP address, and the exact disclosure text shown at point of opt-in. If you can't pull a full consent record for any subscriber, that subscriber should not be on your marketing list.
- Transactional vs. marketing consent: Using transaction consent for marketing—sending promos to customers who only consented to order updates—is one of the most common TCPA compliance mistakes. These must be maintained as separate consent records.
If your SMS and email retention setup has grown organically over a few years, now is a good time for a structured review. A SciGrowth Klaviyo Audit covers exactly this kind of cross-channel consent and flow architecture—we map where consent was captured, how suppression lists are synced, and where the gaps are before they become liabilities.
Why does 10DLC registration matter as much as TCPA consent?
Because you can be fully TCPA-compliant and still have every message blocked. 10DLC (10-digit long code) is required for A2P SMS volume: without 10DLC registration, carriers will filter or block bulk SMS sent via long codes regardless of how clean your TCPA consent is. TCPA-compliant campaigns that bypass 10DLC will not be delivered.
Carrier filtering is now behavioral, not just keyword-based. Message cadence, link density, and sender reputation all influence deliverability. That means even a registered, consent-clean program can take a deliverability hit if you're blasting too frequently or packing every message with shortened URLs. The Campaign Registry requires you to specify what type of messages your campaign sends—marketing, transactional, OTP—and your content must match your registered use case.
The compliance stack for SMS in 2026 is three layers deep: TCPA (legal consent), CTIA (industry standards), and 10DLC (carrier registration). All three need to be right, and skipping any one of them creates problems. The consequences range from fines to carrier filtering to a full block that takes your whole SMS program offline.
What frequency and content rules actually affect your opt-out rate?
This is where compliance meets performance. Getting the legal box checked doesn't protect you from a self-inflicted deliverability problem driven by over-messaging. For ecommerce brands, the recommended frequency is 4–8 messages per month, with an opt-out rate threshold of under 3%.
With rising opt-in rates, controlling message frequency is paramount, as a majority of subscribers cite receiving too many messages as a primary reason for unsubscribing. High-performing brands send four to six messages monthly without hurting retention—but only when messages are relevant and well-segmented. The fastest path to unsubscribes is not irrelevance alone, but irrelevant volume.
Under TCPA, no promotional messages should go out before 8 AM or after 9 PM in the recipient's local time zone. This is a hard legal rule, not a best practice suggestion. If your Klaviyo or Attentive send-time logic isn't timezone-aware, fix it today.
On the opt-out side, if someone opts out of your marketing broadcasts but their number is still active in a CRM workflow that fires follow-up texts, you're still violating TCPA. Opt-outs have to apply everywhere. This is the flow-level suppression sync problem that catches most brands—a contact opts out via STOP reply but the segment logic in a welcome series or abandon flow doesn't check suppression in real time.
What do the performance benchmarks say about the ROI trade-off?
High enough that the compliance investment is clearly worth it. Industry benchmarks for SMS marketing ROI are frequently cited at up to $71 per $1 spent, though most conservative estimates cluster in the $21–$41 range, with results varying significantly by industry, list quality, campaign type, and attribution methodology. The U.S. SMS market size is estimated at $12.6 billion in 2026. Email, for comparison, is commonly benchmarked in the $36–$42 range per $1 spent, though both figures depend heavily on program maturity and channel mix. In 2025, 84% of customers opted in to receive text messages from businesses —which means the audience is there, and the consent infrastructure just needs to match the opportunity.
The channel is clearly worth protecting. A compliance failure that triggers a class action or a carrier block doesn't just cost you a settlement—it wipes out one of your highest-ROI retention channels, often permanently, because rebuilding a suppression-poisoned list from zero is expensive and slow.
What should you do right now?
In priority order: (1) Audit every active opt-in touchpoint—checkout, pop-ups, keyword flows—against the disclosure checklist above. (2) Test your opt-out experience end-to-end: send STOP and verify the suppression fires correctly and within the required timeframe. Document your consent collection method for every subscriber segment. (3) Confirm your 10DLC registration reflects your actual use cases. (4) Set a hard frequency cap and verify your send logic is timezone-aware.
If your SMS and email programs have grown together without a structured review, the safest investment you can make is a full-stack audit before a plaintiff attorney does it for you. A SciGrowth Klaviyo Audit walks through your flows, consent architecture, and suppression logic so you can find the gaps on your timeline, not theirs.
FAQ
- Is the one-to-one consent rule still in effect in 2026?
- No. The FCC's one-to-one consent rule was vacated by the 11th Circuit in January 2025 and formally eliminated by the FCC in late 2025. The safest approach is to name your specific company in the consent disclosure, even though one-to-one consent isn't legally required anymore.
- What are the exact TCPA penalties per text message in 2026?
- Penalties are $500 per message, or up to $1,500 for willful violations. These are statutory damages assessed per individual text sent, meaning a single non-compliant campaign to a large list generates exposure in the millions. Class action structure means plaintiffs aggregate violations across all recipients.
- Do I need a separate opt-in for SMS if I already have email consent?
- Yes, always. SMS requires a separate, explicit opt-in with TCPA-specific disclosure language. A combined checkbox covering both email and SMS does not satisfy TCPA because it doesn't isolate the consumer's agreement to receive marketing texts specifically.
- What opt-out methods must I accept since April 2025?
- Businesses must accept opt-outs via text ("STOP," "quit," "end," "revoke," "opt out," "cancel," "unsubscribe"), email, phone calls, website forms, chatbots, or in-person requests. You must honor opt-outs within 10 business days. One confirmation text is allowed, with no marketing in it.
- What is 10DLC and why does it matter for compliance?
- 10DLC (10-digit long code) is the carrier-level registration system for business SMS in the US. CTIA guidelines enforced by carriers via 10DLC require that your SMS program respond to STOP and other opt-out keywords. This is separate from but consistent with TCPA opt-out obligations. Both must be implemented. Without registration, your messages will be filtered or blocked regardless of legal consent.
- How many SMS messages per month is safe for an ecommerce brand?
- For ecommerce, the recommended frequency is 4–8 messages per month, with an opt-out rate threshold of under 3%. Whatever frequency you disclose at opt-in is also the frequency you're legally bound to—so if you said "up to 4 messages per month" in your consent copy and you're sending 12, you have a disclosure mismatch that creates legal exposure independent of the volume itself.
- Can I text customers who only gave their number for order tracking?
- No—not for marketing. Consumer providing a number at checkout implies consent for order-related messages only. Transactional messages must not include marketing. Mixing promotional content into shipping or order-update flows is one of the most litigated TCPA patterns in e-commerce right now.
Sources:
0 comments